Privacy

Last updated 21 October 2026.

This site has no accounts, no sign-up, no newsletter, no comments and no shop. It never asks you for anything, and there is no form on it to type into. What follows is an account of the little that is collected anyway, by the services that deliver the pages and count the visits.

Who is responsible

The controller of any personal data described here is:

Samu Leino, Finland privacy@oldbelief.com

Write to privacy@oldbelief.com for anything on this page, including any request described under Your rights or California residents below. That address reaches the controller directly; there is no form to fill in and no ticket system.

What is collected

Server and delivery data

The site is hosted on Cloudflare Pages. Like every web server, it processes the information your browser sends in order to deliver a page and to keep the service up: your IP address, the page requested, the referring page if there is one, your browser and operating system, and the time of the request. Cloudflare also uses this information to block attacks and abusive traffic.

Visit measurement

Pages carry Cloudflare Web Analytics. It records, for each page view:

• the page address and the referring address
• the time
• the country, derived from the IP address and not stored with it
• browser, operating system and device type
• page performance timings

It does not set a cookie, does not write to your browser's storage, does not fingerprint your device and does not follow you to other sites. There is no identifier that links one of your visits to another, which is why this site has no cookie banner: nothing is stored on your device for it to ask about.

Fonts

Typefaces are served from this domain. The font files sit on the same server as the pages, so loading them sends nothing to any outside company. Earlier versions of this site loaded them from Google Fonts, which transmitted the visitor's IP address to Google; that was removed.

What is not collected

No name, no email address, no account, no password, no payment information, no precise location, no behavioural profile, no cross-site tracking, and no data about you from any other source. Nothing on this site is personalised to you.

Cookies

This site sets no cookies and uses no local storage. If your browser shows a cookie for this domain, it did not come from here.

Advertising

There is no advertising on this site at the time of writing. The intention is to carry display advertising in future. Advertising networks commonly set cookies, read identifiers and build profiles for targeting, and that would be a genuine change to this page rather than a detail.

If and when advertising starts, this policy will be updated before the first ad appears, with the network named, the data it receives described, and — where the law requires it — a consent choice and an opt-out offered. The Last updated date at the top is how you can tell.

Why this is lawful (GDPR)

For visitors in the European Economic Area and the United Kingdom, the legal basis for processing server and measurement data is legitimate interests under Article 6(1)(f) of the GDPR: operating a website, keeping it secure, and knowing in aggregate which pages people read. The interest is balanced against your rights by the fact that the measurement is cookieless and anonymous, that no profile is built, and that nothing is combined with any other source.

Consent under the ePrivacy rules is not sought because nothing is stored on or read from your device.

Where the data goes

Cloudflare, Inc. is established in the United States and processes data there and in other countries. Transfers out of the EEA rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient participates in it, and otherwise on Standard Contractual Clauses.

Cloudflare is the only company involved. Nothing on this site contacts any other third-party server.

No data from this site is sold, rented, shared for advertising, or passed to anyone beyond the service providers named above.

How long it is kept

Visit measurement is retained in aggregated form for up to six months. Cloudflare's own security and server logs are kept according to its retention schedule, typically days rather than months. Nothing here is kept in a form that identifies you, so there is nothing to delete that is linked to your name.

Your rights

If you are in the EEA or the UK, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. You may exercise any of these by writing to the contact address above.

One honest limitation: because this site stores no identifier that connects a visit to a person, it is usually not possible to find your data in order to show or delete it. Article 11 of the GDPR covers this — a controller is not required to collect extra information about you purely to be able to identify you. If you can supply enough detail to isolate a record, it will be acted on.

There is no automated decision-making and no profiling on this site.

If you believe your data has been handled wrongly, you may complain to a supervisory authority. In Finland that is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Lintulahdenkuja 4, 00530 Helsinki, https://tietosuoja.fi. You may also complain to the authority in your own country of residence.

California residents

This section applies to residents of California and is provided under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). It is provided whether or not this site meets the thresholds that make those laws binding on a business, because you are entitled to know either way.

Categories collected, and why

In the twelve months before the date at the top of this page, the following categories of personal information were collected:

CCPA category	What it is here	Source	Why	Who receives it
Identifiers	IP address	Your browser	Delivering pages, security	Cloudflare
Internet or network activity	Pages viewed, referring page, browser, operating system, device type, performance timings	Your browser	Operating and measuring the site	Cloudflare
Geolocation data (coarse)	Country, derived from IP and not stored with it	Derived	Aggregate statistics	Cloudflare

No other category is collected. In particular: no real name, postal address, email, account, signature, government identifier, financial information, biometric information, precise geolocation, employment or education record, commercial purchase history, or inference drawn to create a profile.

No sensitive personal information as the CPRA defines it is collected, so there is nothing for the right to limit the use of sensitive personal information to apply to.

Sale and sharing

This site does not sell personal information, and has not sold any in the preceding twelve months.

This site does not share personal information for cross-context behavioural advertising, as the CPRA uses the word share, and has not in the preceding twelve months.

There is therefore no "Do Not Sell or Share My Personal Information" link on this site, because there is nothing to opt out of. Should advertising begin and should it involve sharing as defined above, that link will be added at the same time, and this page will say so.

Global Privacy Control. A browser-level opt-out signal such as GPC is honoured as a valid request to opt out of sale and sharing. As nothing is sold or shared, the signal currently changes nothing — but it will be respected if that changes.

Your California rights

• Right to know. What categories are collected, the sources, the purposes, the categories of recipients, and the specific pieces of personal information held about you.
• Right to delete personal information collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — see above.
• Right to limit the use of sensitive personal information — not applicable, as none is collected.
• Right to non-discrimination. Exercising any of these rights will not get you a degraded version of this site. There is only one version, and it is free.

To exercise any of them, write to privacy@oldbelief.com and say which right you are invoking. A response will follow within 45 days, extendable once by a further 45 days with notice. There is no charge. An authorised agent may make a request on your behalf with written permission from you.

Verifying a request has the same practical limit described under Your rights: with no stored identifier, there is usually no record that can be matched to you.

Shine the Light

California Civil Code §1798.83 lets California residents ask a business once a year about disclosures of personal information to third parties for those parties' direct marketing. No such disclosures are made.

Children

This site is written for a general audience and is not directed to children under 13. No personal information is knowingly collected from children under 13, as the Children's Online Privacy Protection Act uses the term, and there is nothing on the site that asks anyone to submit information.

Teachers and students do use material like this. If you believe a child has somehow provided personal information here, write to privacy@oldbelief.com and it will be removed.

Under the GDPR, Finland sets the age for a child's own consent to information society services at 13. Under the CPRA, selling or sharing the personal information of a consumer under 16 requires opt-in consent; as nothing is sold or shared, the situation does not arise.

Security

The site is served over HTTPS only. It is a set of static files with no database, no login and no user-submitted content, which removes most of the ways a website leaks personal data. The infrastructure's security is Cloudflare's.

Changes to this policy

Any material change — above all the start of advertising — will be made on this page with the Last updated date changed at the top. There is no mailing list to notify, so the date is the record.